Spring Framework vulnerable to Denial of Service

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language SpEL expression that may cause a denial of service DoS condition. Older, unsupported versions are also affected. Specifically, an...

com.blogspot.ostas:jamaexamplewebapp (>=1.0.1, <=1.0.2), com.github.bluejoe2008:elfinder-servlet-2 (>=1.0, <=1.2) +439 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.2.3.release)

org.springframework:spring-expression MAVEN version 3.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.blogspot.ostas:jamaexamplewebapp =1.0.1, =1.0, =1.0.0, =1.0.1, =1.2.1 and...

ar.com.jmfsg:api-doc (>=0.0.28, <=0.0.34), ch.ralscha:extdirectspring (>=1.3.2, <=1.3.5) +241 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.2.2.release)

org.springframework:spring-expression MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ar.com.jmfsg:api-doc =0.0.28, =1.3.2, =1.0.0, =1.6.0, =2.100.0, =2.0.2, =2.0....

ch.inftec.ju:ju-dbutil-test-legacy (4.1), ch.ralscha:extdirectspring (>=1.3.0, <=1.3.1) +171 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.2.1.release)

org.springframework:spring-expression MAVEN version 3.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.inftec.ju:ju-dbutil-test-legacy 4.1 - ch.ralscha:extdirectspring =1.3.0,...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +175 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.2.0.release)

org.springframework:spring-expression MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =0.4.0, =0.0.1, =0.0.1, =0.0.1,...

biz.paluch.redis:lettuce (>=3.0.beta1, <=4.0.beta1), biz.paluch.redis:spinach (>=0.1, <=0.3) +326 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.1.4.release)

org.springframework:spring-expression MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - biz.paluch.redis:lettuce =3.0.beta1, =0.1, =1.0.0, =2.0.0-rc1, =1.5, =0.0.1,...

ch.ralscha:extdirectspring (1.2.3), ch.tatool:tatool-app (>=1.3, <=1.3.2) +244 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.1.3.release)

org.springframework:spring-expression MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.ralscha:extdirectspring 1.2.3 - ch.tatool:tatool-app =1.3, =1.3, =1.3,...

ch.epfl.bbp.nlp:bluima_abbreviations (>=1.0.0, <=1.0.1), ch.epfl.bbp.nlp:bluima_corpora (>=1.0.0, <=1.0.1) +732 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.1.2.release)

org.springframework:spring-expression MAVEN version 3.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.epfl.bbp.nlp:bluimaabbreviations =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0,...

ch.hsr.mas.oms-financialanalyzer:indicators (1.2.0), ch.hsr.mas.oms-financialanalyzer:oms-api (1.2.0) +456 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.1.1.release)

org.springframework:spring-expression MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.hsr.mas.oms-financialanalyzer:indicators 1.2.0 -...

br.com.uol.reconf:reconf-spring (>=1.0.4, <=1.4.0), co.jirm:jirm-spring (>=0.0.1, <=0.0.8) +392 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.1.0.release)

org.springframework:spring-expression MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.uol.reconf:reconf-spring =1.0.4, =0.0.1, =1.1, =1.2, =1.1, =0.9.0,...

ar.com.jmfsg:api-doc (>=0.0.20, <=0.0.27), be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3) +679 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.0.7.release)

org.springframework:spring-expression MAVEN version 3.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ar.com.jmfsg:api-doc =0.0.20, =0.3.3, =1.0.14, =1.0, =3.0.10, =3.0.10, =3.0.1...

ar.com.fdvs:dynamicjasper (>=5.0.9, <=5.1.0), br.com.caelum.stella:caelum-stella-boleto (>=2.1.7, <=2.2.2) +842 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.0.6.release)

org.springframework:spring-expression MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ar.com.fdvs:dynamicjasper =5.0.9, =2.1.7, =20.3.0, =20.3.0, =2.23.5, =2.23.5,...

be.eliwan:ew-profiling-api (>=1.0, <=1.4), be.eliwan:ew-profiling-core (>=1.0, <=1.4) +1251 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.0.5.release)

org.springframework:spring-expression MAVEN version 3.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - be.eliwan:ew-profiling-api =1.0, =1.0, =2.0-beta1, =1.1.1, =1.0.2, =1.1.2,...

at.molindo:molindo-notify (>=1.0.0-alpha-1, <=1.0.0-alpha-2), ca.grimoire.spring:spring-request-aware (1.0) +232 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.0.4.release)

org.springframework:spring-expression MAVEN version 3.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo:molindo-notify =1.0.0-alpha-1, =1.0.2, =1.1.1, =1.0.3, =1.0.1,...

br.com.tecsinapse:glimpse-server (>=1.1.1, <=1.1.2), com.alexkasko.springjdbc.typedqueries:typed-queries-codegen (>=1.0, <=1.4.4) +89 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.0.2.release)

org.springframework:spring-expression MAVEN version 3.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.tecsinapse:glimpse-server =1.1.1, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0.0...

cn.smilevers:xxljob-spring-boot-starter (1.8.2-release), com.alibaba.csb.sdk:java (1.1.5.11) +153 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.2.18.release)

org.springframework:spring-expression MAVEN version 3.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.smilevers:xxljob-spring-boot-starter 1.8.2-release -...

club.easy-utils:easy-wepay (>=0.0.1-snaoshot, <=0.0.2-snaoshot), club.easy-utils:easy-weprogram (>=0.0.1-snaoshot, <=1.0.2.1) +69 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.2.17.release)

org.springframework:spring-expression MAVEN version 3.2.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - club.easy-utils:easy-wepay =0.0.1-snaoshot, =0.0.1-snaoshot, =1.2, =1.0.0,...

com.dtflys.forest:forest-spring (1.0.0), com.garethahealy.amq6-dual-jaas-plugin:amq6-dual-jaas-plugin-parent (>=1.2.0-beta2, <=1.4.0) +557 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.2.16.release)

org.springframework:spring-expression MAVEN version 3.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.dtflys.forest:forest-spring 1.0.0 -...

com.free-now.apis:phrase-java-client (>=1.0.8, <=3.0.0), com.free-now.maven.plugins:phrase-plugin (>=2.0.0, <=2.1.0) +79 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.2.15.release)

org.springframework:spring-expression MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.free-now.apis:phrase-java-client =1.0.8, =2.0.0, =2.0.1, =2.0.1, =3.1.0,...

com.att.nsa:msgrtr (0.0.5), com.comcast.magic-wand:appium (>=4.0.1, <=4.0.3) +101 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.2.14.release)

org.springframework:spring-expression MAVEN version 3.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.att.nsa:msgrtr 0.0.5 - com.comcast.magic-wand:appium =4.0.1, =1.0.8,...